Security – Page 20

Optus 2022: 9.8M Records, One Unauthenticated API, Zero Exploits

Post author:Hmmnm
Post published:September 22, 2022
Post category:Identity & Phishing Security Web & API Security

Australia's second-largest telco exposed ~9.8M customer records via an API left unauthenticated in production. No zero-day, no phishing — just enumeration.

Uber’s 2022 Hack: A Bought Password, a Flood of Pushes, and vSphere

Post author:Hmmnm
Post published:September 15, 2022
Post category:Cloud & Infrastructure Identity & Phishing Security

An 18-year-old bought a contractor's Uber password, bombarded them with MFA pushes until one was approved, then roamed to vSphere via hardcoded credentials.

LastPass 2022: The Dev-Environment Breach That Came Back

Post author:Hmmnm
Post published:August 27, 2022
Post category:Cloud & Infrastructure Identity & Phishing Security

August's 'contained' developer-account compromise returned in December as stolen vault backups. Inside the two-act breach.

Plex’s 15M Credential Leak: When Your Forum Post Becomes a Combo List

Post author:Hmmnm
Post published:August 25, 2022
Post category:Identity & Phishing Security

A forums database with bcrypt hashes and salts hit a criminal forum. The real blast radius was everywhere else users reused passwords.

Solana’s 9,000-Wallet Drain: Who Logged the Seed Phrases?

Post author:Hmmnm
Post published:August 18, 2022
Post category:Cryptography & PKI Identity & Phishing Security

Slope's telemetry backend held plaintext seed phrases, and attackers harvested them. The chain saw only valid signatures — and that is the whole lesson.

0ktapus: The SMS Phishing Wave That Hit 130+ Companies

Post author:Hmmnm
Post published:August 8, 2022
Post category:AI & Agent Security Identity & Phishing Security

Fake Okta pages, real-time MFA relay, and one crew harvesting 10,000 identities. Why Cloudflare walked away clean and Twilio didn't.

Nomad Bridge: The $190M Config Bug That Became a Mob Looting

Post author:Hmmnm
Post published:August 2, 2022
Post category:Cryptography & PKI Security

A routine upgrade left message proofs rubber-stamped. Hundreds of copycats drained the bridge in crypto's most chaotic heist.

Twitter’s 5.4M Scrape: When an API Becomes a Breach Oracle

Post author:Hmmnm
Post published:July 23, 2022
Post category:Identity & Phishing Security Web & API Security

A patched OAuth endpoint answered one question too honestly: which phone belongs to which handle. The dataset sold for $30k — the class lesson is still with us.

LockBit 3.0’s Bug Bounty: When Ransomware Ran Its Own QA

Post author:Hmmnm
Post published:July 18, 2022
Post category:Ransomware & Malware Security

A criminal franchise paid up to $1M for flaws in its own malware, website, and Tor infrastructure — Silicon Valley tactics inside the ransomware economy.